Apps offering photo filters, horoscopes or fitness tips may seem innocuous but hundreds of them are stealing people’s Facebook logins.

Parent company Meta said some 1 million Facebook users may have had their Facebook credentials stolen by more than 400 malicious Android and iOS mobile apps they downloaded this year.

The apps were listed in the Google Play Store and Apple’s App Store and disguised themselves as photo editors, games, VPN services, business apps and other utilities.

“We’ve reported these malicious apps to our peers at Apple and Google and they have been taken down from both app stores prior to this report’s publication. We are also alerting people who may have unknowingly self-compromised their accounts by downloading these apps and sharing their credentials, and are helping them to secure their accounts,” according to David Agranovich, director of threat disruption and Ryan Victory, malware discovery and detection engineer.

'Best kept secret of fitness': Mobile video games like Pikmin get kids to exercise outdoors

Kardashians, body image and social media: Why parents should stop filtering their photos

Keeping malicious apps off your phone is a constant struggle. Despite efforts from Apple and Google to keep these apps out of their mobile app stores, scoundrels with designs on your personal information still elude detection. Of the 400 apps Meta uncovered, most were Android apps.

Users should be careful when downloading new apps that ask for social media logins, Meta officials said. The apps often publish fake reviews to drown out negative reviews and trick people into downloading them.

Once the app is installed, users are prompted to log in with Facebook, making it possible for the app to steal the password and username.

“If the login information is stolen, attackers could potentially gain full access to a person’s account and do things like message their friends or access private information,” Meta said.

But loads of legitimate apps require users to log in with their Facebook accounts. How can users tell the difference?